@prosopo/procaptcha-common 2.11.35 → 2.12.0

package/.turbo/turbo-build$colon$cjs.log

@@ -1,5 +1,5 @@
 
-> @prosopo/procaptcha-common@2.11.35 build:cjs
+> @prosopo/procaptcha-common@2.12.0 build:cjs
 > NODE_ENV=${NODE_ENV:-development}; vite build --config vite.cjs.config.ts --mode $NODE_ENV
 
 ViteCommonJSConfig: .
@@ -39,23 +39,24 @@ ViteCommonJSConfig: .
 vite v8.1.5 building ssr environment for production...
 Bundle build started
 
-✓ 15 modules transformed.
+✓ 16 modules transformed.
 rendering chunks...
 computing gzip size...
 dist/cjs/extensionLoader.cjs                 0.27 kB │ gzip: 0.16 kB
 dist/cjs/callbacks/defaultEvents.cjs         0.28 kB │ gzip: 0.16 kB
 dist/cjs/elements/form.cjs                   0.62 kB │ gzip: 0.31 kB
 dist/cjs/simdReadings.cjs                    0.79 kB │ gzip: 0.36 kB
+dist/cjs/clientMetaData.cjs                  0.83 kB │ gzip: 0.47 kB
 dist/cjs/events/trust.cjs                    0.91 kB │ gzip: 0.53 kB
 dist/cjs/elements/window.cjs                 0.96 kB │ gzip: 0.54 kB
 dist/cjs/_virtual/_rolldown/runtime.cjs      1.00 kB │ gzip: 0.50 kB
 dist/cjs/reactComponents/TestModeBanner.cjs  1.36 kB │ gzip: 0.75 kB
 dist/cjs/providers.cjs                       1.54 kB │ gzip: 0.64 kB
 dist/cjs/reactComponents/Honeypot.cjs        2.03 kB │ gzip: 0.91 kB
-dist/cjs/index.cjs                           2.08 kB │ gzip: 0.57 kB
+dist/cjs/index.cjs                           2.22 kB │ gzip: 0.59 kB
 dist/cjs/reactComponents/Reload.cjs          2.94 kB │ gzip: 1.30 kB
 dist/cjs/state/builder.cjs                   3.13 kB │ gzip: 0.84 kB
 dist/cjs/callbacks/defaultCallbacks.cjs      3.84 kB │ gzip: 1.03 kB
 dist/cjs/reactComponents/Checkbox.cjs        5.39 kB │ gzip: 2.12 kB
 
-✓ built in 84ms
+✓ built in 77ms

package/.turbo/turbo-build$colon$tsc.log

@@ -1,8 +1,8 @@
 
-> @prosopo/procaptcha-common@2.11.35 build:tsc
+> @prosopo/procaptcha-common@2.12.0 build:tsc
 > tsc --build --verbose
 
-12:32:26 PM - Projects in this build: 
+1:43:10 PM - Projects in this build: 
     * ../../dev/config/tsconfig.json
     * ../locale/tsconfig.json
     * ../util/tsconfig.json
@@ -18,35 +18,35 @@
     * ../account/tsconfig.json
     * tsconfig.json
 
-12:32:26 PM - Project '../../dev/config/tsconfig.json' is up to date because newest input '../../dev/config/src/webpack/webpack.config.ts' is older than output '../../dev/config/tsconfig.tsbuildinfo'
+1:43:10 PM - Project '../../dev/config/tsconfig.json' is up to date because newest input '../../dev/config/src/webpack/webpack.config.ts' is older than output '../../dev/config/tsconfig.tsbuildinfo'
 
-12:32:26 PM - Project '../locale/tsconfig.json' is up to date because newest input '../locale/src/translationKey.ts' is older than output '../locale/tsconfig.tsbuildinfo'
+1:43:10 PM - Project '../locale/tsconfig.json' is up to date because newest input '../locale/src/translationKey.ts' is older than output '../locale/tsconfig.tsbuildinfo'
 
-12:32:26 PM - Project '../util/tsconfig.json' is up to date because newest input '../util/src/url.ts' is older than output '../util/tsconfig.tsbuildinfo'
+1:43:10 PM - Project '../util/tsconfig.json' is up to date because newest input '../util/src/url.ts' is older than output '../util/tsconfig.tsbuildinfo'
 
-12:32:26 PM - Project '../logger/tsconfig.json' is up to date because newest input '../logger/src/tests/loggerBrowser.unit.test.ts' is older than output '../logger/tsconfig.tsbuildinfo'
+1:43:10 PM - Project '../logger/tsconfig.json' is up to date because newest input '../logger/src/index.ts' is older than output '../logger/tsconfig.tsbuildinfo'
 
-12:32:26 PM - Project '../util-crypto/tsconfig.json' is up to date because newest input '../util-crypto/src/types.ts' is older than output '../util-crypto/tsconfig.tsbuildinfo'
+1:43:10 PM - Project '../util-crypto/tsconfig.json' is up to date because newest input '../util-crypto/src/types.ts' is older than output '../util-crypto/tsconfig.tsbuildinfo'
 
-12:32:26 PM - Project '../types/tsconfig.json' is up to date because newest input '../types/src/types.test-d.ts' is older than output '../types/tsconfig.tsbuildinfo'
+1:43:10 PM - Project '../types/tsconfig.json' is up to date because newest input '../types/src/types.test-d.ts' is older than output '../types/tsconfig.tsbuildinfo'
 
-12:32:26 PM - Project '../common/tsconfig.json' is up to date because newest input '../common/src/tests/utils/objectUtils.unit.test.ts' is older than output '../common/tsconfig.tsbuildinfo'
+1:43:10 PM - Project '../common/tsconfig.json' is up to date because newest input '../common/src/index.ts' is older than output '../common/tsconfig.tsbuildinfo'
 
-12:32:26 PM - Project '../load-balancer/tsconfig.json' is up to date because newest input '../load-balancer/src/tests/providers.unit.test.ts' is older than output '../load-balancer/tsconfig.tsbuildinfo'
+1:43:10 PM - Project '../load-balancer/tsconfig.json' is up to date because newest input '../load-balancer/src/balancer.ts' is older than output '../load-balancer/tsconfig.tsbuildinfo'
 
-12:32:26 PM - Project '../widget-skeleton/tsconfig.json' is up to date because newest input '../widget-skeleton/src/webComponent/createWidget.ts' is older than output '../widget-skeleton/tsconfig.tsbuildinfo'
+1:43:10 PM - Project '../widget-skeleton/tsconfig.json' is up to date because newest input '../widget-skeleton/src/theme.ts' is older than output '../widget-skeleton/tsconfig.tsbuildinfo'
 
-12:32:26 PM - Project '../fingerprintjs/tsconfig.json' is up to date because newest input '../fingerprintjs/src/utils/browser.ts' is older than output '../fingerprintjs/tsconfig.tsbuildinfo'
+1:43:10 PM - Project '../fingerprintjs/tsconfig.json' is up to date because newest input '../fingerprintjs/src/utils/browser.ts' is older than output '../fingerprintjs/tsconfig.tsbuildinfo'
 
-12:32:26 PM - Project '../fingerprint/tsconfig.json' is up to date because newest input '../fingerprint/src/index.ts' is older than output '../fingerprint/tsconfig.tsbuildinfo'
+1:43:10 PM - Project '../fingerprint/tsconfig.json' is up to date because newest input '../fingerprint/src/merkle.ts' is older than output '../fingerprint/tsconfig.tsbuildinfo'
 
-12:32:26 PM - Project '../keyring/tsconfig.json' is up to date because newest input '../keyring/src/pair/decode.ts' is older than output '../keyring/tsconfig.tsbuildinfo'
+1:43:10 PM - Project '../keyring/tsconfig.json' is up to date because newest input '../keyring/src/keyring/keyring.test.ts' is older than output '../keyring/tsconfig.tsbuildinfo'
 
-12:32:26 PM - Project '../account/tsconfig.json' is out of date because output file '../account/tsconfig.tsbuildinfo' does not exist
+1:43:10 PM - Project '../account/tsconfig.json' is out of date because output file '../account/tsconfig.tsbuildinfo' does not exist
 
-12:32:26 PM - Building project '/home/runner/work/captcha/captcha/packages/account/tsconfig.json'...
+1:43:10 PM - Building project '/home/runner/work/captcha/captcha/packages/account/tsconfig.json'...
 
-12:32:29 PM - Project 'tsconfig.json' is out of date because output file 'tsconfig.tsbuildinfo' does not exist
+1:43:13 PM - Project 'tsconfig.json' is out of date because output file 'tsconfig.tsbuildinfo' does not exist
 
-12:32:29 PM - Building project '/home/runner/work/captcha/captcha/packages/procaptcha-common/tsconfig.json'...
+1:43:13 PM - Building project '/home/runner/work/captcha/captcha/packages/procaptcha-common/tsconfig.json'...
 

package/.turbo/turbo-build.log

@@ -1,9 +1,9 @@
 
-> @prosopo/procaptcha-common@2.11.35 build
+> @prosopo/procaptcha-common@2.12.0 build
 > npm run build:cross-env -- --mode ${NODE_ENV:-development}
 
 
-> @prosopo/procaptcha-common@2.11.35 build:cross-env
+> @prosopo/procaptcha-common@2.12.0 build:cross-env
 > vite build --config vite.esm.config.ts --mode production
 
 ViteEsmConfig: .
@@ -43,7 +43,7 @@ ViteEsmConfig: .
 vite v8.1.5 building ssr environment for production...
 Bundle build started
 
-✓ 15 modules transformed.
+✓ 16 modules transformed.
 rendering chunks...
 computing gzip size...
 dist/_virtual/_rolldown/runtime.js      0.04 kB │ gzip: 0.06 kB
@@ -51,10 +51,11 @@ dist/callbacks/defaultEvents.js         0.23 kB │ gzip: 0.15 kB
 dist/extensionLoader.js                 0.25 kB │ gzip: 0.16 kB
 dist/elements/form.js                   0.56 kB │ gzip: 0.30 kB
 dist/simdReadings.js                    0.72 kB │ gzip: 0.35 kB
+dist/clientMetaData.js                  0.81 kB │ gzip: 0.47 kB
 dist/events/trust.js                    0.89 kB │ gzip: 0.52 kB
 dist/elements/window.js                 0.91 kB │ gzip: 0.53 kB
 dist/reactComponents/TestModeBanner.js  1.23 kB │ gzip: 0.71 kB
-dist/index.js                           1.27 kB │ gzip: 0.44 kB
+dist/index.js                           1.35 kB │ gzip: 0.46 kB
 dist/providers.js                       1.41 kB │ gzip: 0.62 kB
 dist/reactComponents/Honeypot.js        1.86 kB │ gzip: 0.89 kB
 dist/reactComponents/Reload.js          2.69 kB │ gzip: 1.26 kB
@@ -62,4 +63,4 @@ dist/state/builder.js                   3.09 kB │ gzip: 0.84 kB
 dist/callbacks/defaultCallbacks.js      3.64 kB │ gzip: 1.00 kB
 dist/reactComponents/Checkbox.js        4.87 kB │ gzip: 2.04 kB
 
-✓ built in 90ms
+✓ built in 92ms

package/CHANGELOG.md

@@ -1,5 +1,25 @@
 # @prosopo/procaptcha-common
 
+## 2.12.0
+### Minor Changes
+
+- 4b1cb19: Correlate a site-supplied session id across render and verify.
+  
+  A site can now hand the widget its own session identifier — Protect's JTI, or any per-user session id it already holds — and have the provider confirm at verify time that the token was earned in that same session. Render it with `data-sessionid="..."` or `renderOptions.sessionId`, resolved the same way `mode` and `language` already are, so implicit, explicit and invisible-button renders all pick it up. Pass the same value as the new trailing `clientSessionId` argument to `ProsopoServer.isVerified`.
+  
+  The widget attaches it to the solution as `clientMetaData.clientSessionId`. It is persisted on the captcha record (PoW, puzzle and image alike) and mirrored to a new top-level `clientMetaData` key on the session record — an object rather than a flat field, because more render-time metadata is expected to land there. It survives the PoW→image/puzzle escalation handoff, since the escalated widget is mounted with the same config.
+  
+  At verify, when the value is supplied and the solve does not carry exactly that value — including carrying none at all, which is what a token minted outside the site's session looks like — the token is disapproved with the new `ResultReason.CLIENT_SESSION_MISMATCH` (`API.CLIENT_SESSION_MISMATCH`, translated in all 31 locales), recorded on both the captcha record and the session.
+  
+  Omitting the id preserves existing behaviour, so this is opt-in and backward compatible. The verify request field is `clientSessionId` rather than `sessionId` because `VerificationResponse.sessionId` already means the provider's own frictionless session; same-named request and response fields meaning different things would be a trap for integrators.
+
+### Patch Changes
+
+- Updated dependencies [4b1cb19]
+  - @prosopo/types@5.4.0
+  - @prosopo/account@2.8.82
+  - @prosopo/load-balancer@2.10.33
+
 ## 2.11.35
 ### Patch Changes
 

package/dist/cjs/clientMetaData.cjs

@@ -0,0 +1,22 @@
+//#region src/clientMetaData.ts
+/**
+* Assembles the widget-controlled metadata attached to a captcha solution.
+* Shared by the image, PoW and puzzle managers so a new field only has to be
+* threaded in once.
+*
+* Returns `undefined` when nothing is set, so the submission body omits the
+* key entirely rather than carrying an empty object.
+*
+* @param hp - live honeypot input value, if the honeypot was filled in
+* @param clientSessionId - the site's session id, if the widget was rendered
+*   with `data-sessionid` / `renderOptions.sessionId`
+*/
+var buildClientMetaData = (hp, clientSessionId) => {
+	const clientMetaData = {
+		...hp && { hp },
+		...clientSessionId && { clientSessionId }
+	};
+	return Object.keys(clientMetaData).length > 0 ? clientMetaData : void 0;
+};
+//#endregion
+exports.buildClientMetaData = buildClientMetaData;

package/dist/cjs/index.cjs

@@ -1,5 +1,6 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 const require_providers = require("./providers.cjs");
+const require_clientMetaData = require("./clientMetaData.cjs");
 const require_trust = require("./events/trust.cjs");
 const require_builder = require("./state/builder.cjs");
 const require_window = require("./elements/window.cjs");
@@ -17,6 +18,7 @@ exports.Honeypot = require_Honeypot.Honeypot;
 exports.ReloadButton = require_Reload.ReloadButton;
 exports.SIMD_READINGS_SUBMIT_TIMEOUT_MS = require_simdReadings.SIMD_READINGS_SUBMIT_TIMEOUT_MS;
 exports.TestModeBanner = require_TestModeBanner.TestModeBanner;
+exports.buildClientMetaData = require_clientMetaData.buildClientMetaData;
 exports.buildUpdateState = require_builder.buildUpdateState;
 exports.getDefaultCallbacks = require_defaultCallbacks.getDefaultCallbacks;
 exports.getDefaultEvents = require_defaultEvents.getDefaultEvents;

package/dist/clientMetaData.d.ts

@@ -0,0 +1,3 @@
+import type { ClientMetaData } from "@prosopo/types";
+export declare const buildClientMetaData: (hp?: string, clientSessionId?: string) => ClientMetaData | undefined;
+//# sourceMappingURL=clientMetaData.d.ts.map

package/dist/clientMetaData.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"clientMetaData.d.ts","sourceRoot":"","sources":["../src/clientMetaData.ts"],"names":[],"mappings":"AAcA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAcrD,eAAO,MAAM,mBAAmB,QAC1B,MAAM,oBACO,MAAM,KACtB,cAAc,GAAG,SAOnB,CAAC"}

package/dist/clientMetaData.js

@@ -0,0 +1,22 @@
+//#region src/clientMetaData.ts
+/**
+* Assembles the widget-controlled metadata attached to a captcha solution.
+* Shared by the image, PoW and puzzle managers so a new field only has to be
+* threaded in once.
+*
+* Returns `undefined` when nothing is set, so the submission body omits the
+* key entirely rather than carrying an empty object.
+*
+* @param hp - live honeypot input value, if the honeypot was filled in
+* @param clientSessionId - the site's session id, if the widget was rendered
+*   with `data-sessionid` / `renderOptions.sessionId`
+*/
+var buildClientMetaData = (hp, clientSessionId) => {
+	const clientMetaData = {
+		...hp && { hp },
+		...clientSessionId && { clientSessionId }
+	};
+	return Object.keys(clientMetaData).length > 0 ? clientMetaData : void 0;
+};
+//#endregion
+export { buildClientMetaData };

package/dist/clientMetaData.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"clientMetaData.js","sourceRoot":"","sources":["../src/clientMetaData.ts"],"names":[],"mappings":"AA4BA,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAClC,EAAW,EACX,eAAwB,EACK,EAAE;IAC/B,MAAM,cAAc,GAAmB;QACtC,GAAG,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC;QACjB,GAAG,CAAC,eAAe,IAAI,EAAE,eAAe,EAAE,CAAC;KAC3C,CAAC;IAEF,OAAO,MAAM,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,SAAS,CAAC;AAC5E,CAAC,CAAC"}

package/dist/index.d.ts

@@ -1,4 +1,5 @@
 export * from "./providers.js";
+export * from "./clientMetaData.js";
 export * from "./events/trust.js";
 export * from "./state/builder.js";
 export * from "./callbacks/defaultCallbacks.js";

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAcA,cAAc,gBAAgB,CAAC;AAC/B,cAAc,mBAAmB,CAAC;AAClC,cAAc,oBAAoB,CAAC;AACnC,cAAc,iCAAiC,CAAC;AAChD,cAAc,8BAA8B,CAAC;AAC7C,cAAc,sBAAsB,CAAC;AACrC,cAAc,mBAAmB,CAAC;AAClC,cAAc,sBAAsB,CAAC;AACrC,cAAc,6BAA6B,CAAC;AAC5C,cAAc,+BAA+B,CAAC;AAC9C,cAAc,+BAA+B,CAAC;AAC9C,cAAc,qCAAqC,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAcA,cAAc,gBAAgB,CAAC;AAC/B,cAAc,qBAAqB,CAAC;AACpC,cAAc,mBAAmB,CAAC;AAClC,cAAc,oBAAoB,CAAC;AACnC,cAAc,iCAAiC,CAAC;AAChD,cAAc,8BAA8B,CAAC;AAC7C,cAAc,sBAAsB,CAAC;AACrC,cAAc,mBAAmB,CAAC;AAClC,cAAc,sBAAsB,CAAC;AACrC,cAAc,6BAA6B,CAAC;AAC5C,cAAc,+BAA+B,CAAC;AAC9C,cAAc,+BAA+B,CAAC;AAC9C,cAAc,qCAAqC,CAAC"}

package/dist/index.js

@@ -1,5 +1,6 @@
 import "./_virtual/_rolldown/runtime.js";
 import { getProcaptchaRandomActiveProvider, getRetryDelayMs, pickIpMode, providerRetry } from "./providers.js";
+import { buildClientMetaData } from "./clientMetaData.js";
 import { isEventTrusted } from "./events/trust.js";
 import { buildUpdateState, useProcaptcha } from "./state/builder.js";
 import { getWindowCallback, isSecureBrowserContext } from "./elements/window.js";
@@ -11,4 +12,4 @@ import { ReloadButton } from "./reactComponents/Reload.js";
 import { Checkbox } from "./reactComponents/Checkbox.js";
 import { Honeypot } from "./reactComponents/Honeypot.js";
 import { TestModeBanner } from "./reactComponents/TestModeBanner.js";
-export { Checkbox, ExtensionLoader, Honeypot, ReloadButton, SIMD_READINGS_SUBMIT_TIMEOUT_MS, TestModeBanner, buildUpdateState, getDefaultCallbacks, getDefaultEvents, getProcaptchaRandomActiveProvider, getRetryDelayMs, getSimdReadingsForSubmit, getWindowCallback, isEventTrusted, isSecureBrowserContext, pickIpMode, providerRetry, setUserCallbacks, useProcaptcha };
+export { Checkbox, ExtensionLoader, Honeypot, ReloadButton, SIMD_READINGS_SUBMIT_TIMEOUT_MS, TestModeBanner, buildClientMetaData, buildUpdateState, getDefaultCallbacks, getDefaultEvents, getProcaptchaRandomActiveProvider, getRetryDelayMs, getSimdReadingsForSubmit, getWindowCallback, isEventTrusted, isSecureBrowserContext, pickIpMode, providerRetry, setUserCallbacks, useProcaptcha };

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAcA,cAAc,gBAAgB,CAAC;AAC/B,cAAc,mBAAmB,CAAC;AAClC,cAAc,oBAAoB,CAAC;AACnC,cAAc,iCAAiC,CAAC;AAChD,cAAc,8BAA8B,CAAC;AAC7C,cAAc,sBAAsB,CAAC;AACrC,cAAc,mBAAmB,CAAC;AAClC,cAAc,sBAAsB,CAAC;AACrC,cAAc,6BAA6B,CAAC;AAC5C,cAAc,+BAA+B,CAAC;AAC9C,cAAc,+BAA+B,CAAC;AAC9C,cAAc,qCAAqC,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAcA,cAAc,gBAAgB,CAAC;AAC/B,cAAc,qBAAqB,CAAC;AACpC,cAAc,mBAAmB,CAAC;AAClC,cAAc,oBAAoB,CAAC;AACnC,cAAc,iCAAiC,CAAC;AAChD,cAAc,8BAA8B,CAAC;AAC7C,cAAc,sBAAsB,CAAC;AACrC,cAAc,mBAAmB,CAAC;AAClC,cAAc,sBAAsB,CAAC;AACrC,cAAc,6BAA6B,CAAC;AAC5C,cAAc,+BAA+B,CAAC;AAC9C,cAAc,+BAA+B,CAAC;AAC9C,cAAc,qCAAqC,CAAC"}

package/dist/tests/clientMetaData.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=clientMetaData.test.d.ts.map

package/dist/tests/clientMetaData.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"clientMetaData.test.d.ts","sourceRoot":"","sources":["../../src/tests/clientMetaData.test.ts"],"names":[],"mappings":""}

package/dist/tests/clientMetaData.test.js

@@ -0,0 +1,27 @@
+import { describe, expect, it } from "vitest";
+import { buildClientMetaData } from "../clientMetaData.js";
+describe("buildClientMetaData", () => {
+    it("returns undefined when the widget has nothing to report", () => {
+        expect(buildClientMetaData(undefined, undefined)).toBeUndefined();
+    });
+    it("returns undefined for empty strings rather than an empty object", () => {
+        expect(buildClientMetaData("", "")).toBeUndefined();
+    });
+    it("reports the honeypot value alone", () => {
+        expect(buildClientMetaData("bot-typed-this", undefined)).toEqual({
+            hp: "bot-typed-this",
+        });
+    });
+    it("reports the client session id alone", () => {
+        expect(buildClientMetaData(undefined, "jti-1")).toEqual({
+            clientSessionId: "jti-1",
+        });
+    });
+    it("reports both when both are present", () => {
+        expect(buildClientMetaData("trap", "jti-1")).toEqual({
+            hp: "trap",
+            clientSessionId: "jti-1",
+        });
+    });
+});
+//# sourceMappingURL=clientMetaData.test.js.map

package/dist/tests/clientMetaData.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"clientMetaData.test.js","sourceRoot":"","sources":["../../src/tests/clientMetaData.test.ts"],"names":[],"mappings":"AAcA,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AAC9C,OAAO,EAAE,mBAAmB,EAAE,MAAM,sBAAsB,CAAC;AAE3D,QAAQ,CAAC,qBAAqB,EAAE,GAAG,EAAE;IACpC,EAAE,CAAC,yDAAyD,EAAE,GAAG,EAAE;QAClE,MAAM,CAAC,mBAAmB,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC,CAAC,aAAa,EAAE,CAAC;IACnE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,iEAAiE,EAAE,GAAG,EAAE;QAC1E,MAAM,CAAC,mBAAmB,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,aAAa,EAAE,CAAC;IACrD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,kCAAkC,EAAE,GAAG,EAAE;QAC3C,MAAM,CAAC,mBAAmB,CAAC,gBAAgB,EAAE,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC;YAChE,EAAE,EAAE,gBAAgB;SACpB,CAAC,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,qCAAqC,EAAE,GAAG,EAAE;QAC9C,MAAM,CAAC,mBAAmB,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC;YACvD,eAAe,EAAE,OAAO;SACxB,CAAC,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,oCAAoC,EAAE,GAAG,EAAE;QAC7C,MAAM,CAAC,mBAAmB,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC;YACpD,EAAE,EAAE,MAAM;YACV,eAAe,EAAE,OAAO;SACxB,CAAC,CAAC;IACJ,CAAC,CAAC,CAAC;AACJ,CAAC,CAAC,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@prosopo/procaptcha-common",
-	"version": "2.11.35",
+	"version": "2.12.0",
 	"author": "PROSOPO LIMITED <info@prosopo.io>",
 	"license": "Apache-2.0",
 	"main": "dist/index.js",
@@ -34,9 +34,9 @@
 	"dependencies": {
 		"@emotion/react": "11.14.0",
 		"@emotion/styled": "11.14.1",
-		"@prosopo/account": "2.8.81",
-		"@prosopo/load-balancer": "2.10.32",
-		"@prosopo/types": "5.3.0",
+		"@prosopo/account": "2.8.82",
+		"@prosopo/load-balancer": "2.10.33",
+		"@prosopo/types": "5.4.0",
 		"@prosopo/widget-skeleton": "2.8.6",
 		"react": "19.2.8",
 		"react-dom": "19.2.8"

package/src/clientMetaData.ts

@@ -0,0 +1,39 @@
+// Copyright 2021-2026 Prosopo (UK) Ltd.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+import type { ClientMetaData } from "@prosopo/types";
+
+/**
+ * Assembles the widget-controlled metadata attached to a captcha solution.
+ * Shared by the image, PoW and puzzle managers so a new field only has to be
+ * threaded in once.
+ *
+ * Returns `undefined` when nothing is set, so the submission body omits the
+ * key entirely rather than carrying an empty object.
+ *
+ * @param hp - live honeypot input value, if the honeypot was filled in
+ * @param clientSessionId - the site's session id, if the widget was rendered
+ *   with `data-sessionid` / `renderOptions.sessionId`
+ */
+export const buildClientMetaData = (
+	hp?: string,
+	clientSessionId?: string,
+): ClientMetaData | undefined => {
+	const clientMetaData: ClientMetaData = {
+		...(hp && { hp }),
+		...(clientSessionId && { clientSessionId }),
+	};
+
+	return Object.keys(clientMetaData).length > 0 ? clientMetaData : undefined;
+};

package/src/index.ts

@@ -13,6 +13,7 @@
 // limitations under the License.
 
 export * from "./providers.js";
+export * from "./clientMetaData.js";
 export * from "./events/trust.js";
 export * from "./state/builder.js";
 export * from "./callbacks/defaultCallbacks.js";

package/src/tests/clientMetaData.test.ts

@@ -0,0 +1,45 @@
+// Copyright 2021-2026 Prosopo (UK) Ltd.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+import { describe, expect, it } from "vitest";
+import { buildClientMetaData } from "../clientMetaData.js";
+
+describe("buildClientMetaData", () => {
+	it("returns undefined when the widget has nothing to report", () => {
+		expect(buildClientMetaData(undefined, undefined)).toBeUndefined();
+	});
+
+	it("returns undefined for empty strings rather than an empty object", () => {
+		expect(buildClientMetaData("", "")).toBeUndefined();
+	});
+
+	it("reports the honeypot value alone", () => {
+		expect(buildClientMetaData("bot-typed-this", undefined)).toEqual({
+			hp: "bot-typed-this",
+		});
+	});
+
+	it("reports the client session id alone", () => {
+		expect(buildClientMetaData(undefined, "jti-1")).toEqual({
+			clientSessionId: "jti-1",
+		});
+	});
+
+	it("reports both when both are present", () => {
+		expect(buildClientMetaData("trap", "jti-1")).toEqual({
+			hp: "trap",
+			clientSessionId: "jti-1",
+		});
+	});
+});